Security & Encryption
How we protect your data on a platform built by a security company. We eat our own dog food.
In transit
- HTTPS everywhere — all studio sites and APIs use TLS.
- Calls (voice/video) use WebRTC with encrypted media channels.
- HSTS headers on Vercel-hosted sites.
At rest
- Passwords are never stored in plaintext — hashed, and we push for the strongest scheme the platform supports.
- Messages and account data live in Netlify storage with platform-level encryption at rest.
- Sensitive research tooling (DarkWebScraper Pro) supports encrypted case files and evidence packaging.
Operations
- Admin actions (account resets, access grants, investigations) are owner-only and manual.
- Reports and abuse records are human-reviewed, never algorithm-judged.
- We practice the responsible disclosure process ourselves — and welcome reports.
- We don't run ads, trackers, or third-party analytics — less surface area, fewer leaks.
Limits
We're a small studio on managed infrastructure (Netlify, Gmail, WebRTC). We protect what we control, document what we don't, and fix fast when something's off. See Responsible Disclosure →
Threat model
We protect against: casual data exposure, credential reuse attacks, spam/fraud, and content-safety failures. We don't claim to defend against nation-state adversaries — and we say so honestly instead of pretending otherwise.
What's protected
- Accounts: hashed credentials, device-local sessions, owner-only reset flow.
- Messages: encrypted in transit, platform-level encryption at rest.
- Calls: WebRTC encrypted media channels.
- Reports/evidence: restricted to the owner, never automated-scanned.
What we don't store
- Plaintext passwords.
- Payment card numbers (payments are manual, off-platform).
- Unnecessary logs (30-day IP retention).
Security reviews
Public repos get dependency scans and manual review. SoundLink and docs are reviewed on each big deploy. We welcome outside review via responsible disclosure → — no legal threats for good-faith reports, and we credit reporters.
⚖️ Legal basis & applicable law
These are the primary provisions that anchor this page. They are cited as article — statute — jurisdiction so you can verify each one against the official text.
| Provision | What it governs here |
|---|---|
Art. 32, Regulation (EU) 2016/679 (GDPR), EU | Security of processing: encryption, access control, resilience. |
Art. 25, Regulation (EU) 2016/679 (GDPR), EU | Data protection by design and by default. |
Art. 23, Directive (EU) 2022/2555 (NIS2), EU | Incident-reporting duties where NIS2 applies to our infrastructure. |